[OpenID] OpenID based on email addresses... Just Works!

[Martin Atkins]

David Fuelling wrote:
> 
> So my grandma has a yahoo.com <http://yahoo.com> email address (she 
> doesn't really, but for the sake of illustration).  She types 
> 'grandma at yahoo.com <mailto:grandma at yahoo.com>' into an RP, and in 2008, 
> she'll use Yahoo.com as her OP.  But in 2009 (hypothetically), Yahoo 
> introduces the ability to "link" your email address to any OpenID of 
> your choosing.  They setup a control panel to facilitate this, etc.  My 
> grandma, being not that sophisticated, will likely continue using 
> Yahoo.  But me -- I'll be able to now link my yahoo.com 
> <http://yahoo.com> email address to my sappenin.com 
> <http://sappenin.com> OpenID.  In 2012 (assume my grandma is kind of 
> young), I go over to her house and say, "Grandma, did you know that if 
> you start using Google.com as your Identity Provider, they'll pay you $1 
> every time you login to a site, because they're Google and they can do 
> that sort of thing?".  My grandma will say something like, "Wow, I use 
> the computer a lot, and that will subsidize my social security -- Thanks 
> Google!".  And oh, by the way, since it's 2012, Google has an automated 
> system to do all of this for my Grandma, so she doesn't even need my 
> help to let Google subsidize her social security.   She simply switches 
> over her OpenID email mapping/Delegation information.....but retains her 
> email yahoo email address as her "login mechanism".
> 

Of course, as soon as you change the URL underlying your email address, 
you effectively become a new user on all RPs where you use that email 
address.

This is exactly the sort of confusion I'm thinking of when I say that 
adding this extra layer of indirection is confusing. I'm still typing in 
the same email address, so why can't I access my account?

I think this is one situation where simpler is better. If there's only 
one identifier in play then you know where you stand.